> You will still see security teams pushing endpoint protection with kernel level observability onto air-gapped systems

Why though? Is it just "because we do it on every other machine", scared to fail audit, or what? Obviously the regulatory environment is a problem but IT incompetence is also another.